PkgRadar

Package evidence

[email protected]

Known Indicator Filename: package/dist/lib/bundle.js

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"review"}'
Publisherliuneng1994
Artifact bytes4,023,930
Previous version0.1.4
Published2026-05-25T07:07:22.229Z
SHA-2565c4d1e83dae466042a4138d77a7e245da035e8c23079d8bfe3e66db973eb1a63

Why flagged

What the scanner saw

Known Indicator Filename: package/dist/lib/bundle.js

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
174Score
0.1.5Version
Status history (1 event)
  1. newavailable · risk review · score 174 · status changed

Evidence

Static findings

44 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
highKnown Indicator Filenamepackage/dist/lib/bundle.jspackage/dist/lib/bundle.js45
mediumObfuscation Densitypackage/dist-bundle/web/assets/chunk-727SXJPM-Dgiqi2fO.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist-bundle/web/assets/flowDiagram-I6XJVG4X-CbMNHcpV.jshigh encoded/escaped-token density12
Show all 44 findings (low-signal and informational)
SeverityKindPathDetailPoints
highKnown Indicator Filenamepackage/dist/lib/bundle.jspackage/dist/lib/bundle.js45
mediumObfuscation Densitypackage/dist-bundle/web/assets/chunk-727SXJPM-Dgiqi2fO.jshigh encoded/escaped-token density12
mediumObfuscation Densitypackage/dist-bundle/web/assets/flowDiagram-I6XJVG4X-CbMNHcpV.jshigh encoded/escaped-token density12
lowCredential file accesspackage/dist-bundle/web/assets/ssh-config-_ykCGR6B.jsmatched ".ssh"5
lowObfuscationpackage/dist-bundle/web/assets/ara-BRHolxvo.jsmatched "\\x7F"3
lowObfuscationpackage/dist-bundle/web/assets/blade-2xfisSek.jsmatched "\\x7F"3
lowObfuscationpackage/dist-bundle/web/assets/blockDiagram-GPEHLZMM-BQTKoJrp.jsmatched "\\u000D"3
lowObfuscationpackage/dist-bundle/web/assets/c4Diagram-AAUBKEIU-DbzEB8SA.jsmatched "eVal("3
lowObfuscationpackage/dist-bundle/web/assets/chunk-727SXJPM-Dgiqi2fO.jsmatched "\\u00AA"3
lowObfuscationpackage/dist-bundle/web/assets/coffee-Ch7k5sss.jsmatched "fromCharCode"3
lowObfuscationpackage/dist-bundle/web/assets/crystal-DGywbUpC.jsmatched "\\x08"3
lowObfuscationpackage/dist-bundle/web/assets/css-CLj8gQPS.jsmatched "\\uFEFF"3
lowObfuscationpackage/dist-bundle/web/assets/cytoscape.esm-BHYC38rz.jsmatched "\\u200b"3
lowObfuscationpackage/dist/commands/doctor.jsmatched "\\x1b"3
lowObfuscationpackage/dist-bundle/web/assets/erDiagram-TEJ5UH35-CfontV_K.jsmatched "\\u00C0"3
lowObfuscationpackage/dist-bundle/web/assets/flowDiagram-I6XJVG4X-CbMNHcpV.jsmatched "\\u00AA"3
lowObfuscationpackage/dist-bundle/web/assets/glimmer-js-ByusRIyA.jsmatched "\\x08"3
lowObfuscationpackage/dist-bundle/web/assets/glimmer-ts-BfAWNZQY.jsmatched "\\x08"3
lowObfuscationpackage/dist-bundle/web/assets/hack-DbPARsA_.jsmatched "\\x7F"3
lowObfuscationpackage/dist-bundle/web/assets/html-pp8916En.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/index-Bse6oThM.jsmatched "\\u00C0"3
lowObfuscationpackage/dist-bundle/web/assets/index-DzSXo8Hy.jsmatched "\\u2028"3
lowObfuscationpackage/dist-bundle/web/assets/journeyDiagram-JHISSGLW-BlEGUN50.jsmatched "eVal("3
lowObfuscationpackage/dist-bundle/web/assets/julia-D7OTSIA_.jsmatched "\\x01"3
lowObfuscationpackage/dist-bundle/web/assets/katex-BTI-AXqd.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/katex-C5jXJg4s.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/less-B1dDrJ26.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/mermaid.core-BDlJIfVk.jsmatched "\\x1B"3
lowObfuscationpackage/dist-bundle/server/extensions/parse-plugins.jsmatched "fromCharCode"3
lowObfuscationpackage/dist-bundle/server/extensions/parse-skills.jsmatched "fromCharCode"3
lowObfuscationpackage/dist-bundle/web/assets/php-Csjmro_R.jsmatched "\\x7F"3
lowObfuscationpackage/dist-bundle/web/assets/puppet-BMWR74SV.jsmatched "\\x7F"3
lowObfuscationpackage/dist-bundle/web/assets/quadrantDiagram-W4KKPZXB-FhbvHg5n.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/ruby-DyJCeAvU.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/sankeyDiagram-5OEKKPKP-AzwVD9EQ.jsmatched "\\u000D"3
lowObfuscationpackage/dist-bundle/web/assets/scss-D5BDwBP9.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/sequenceDiagram-3UESZ5HK-Db6KmIzT.jsmatched "eVal("3
lowObfuscationpackage/dist-bundle/web/assets/stata-DI20mbqo.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/stylus-BEDo0Tqx.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/twig-CW1WmMYd.jsmatched "\\x7F"3
lowObfuscationpackage/dist-bundle/web/assets/typst-DHCkPAjA.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/vue-D2xRrEX4.jsmatched "\\x00"3
lowObfuscationpackage/dist-bundle/web/assets/wardley-L42UT6IY-CMdDhGCS.jsmatched "\\u2028"3
lowObfuscationpackage/dist-bundle/web/assets/wasm-CG6Dc4jp.jsmatched "atob("3

Manifest

Package metadata

Scripts3
  • buildtsc && node ../../scripts/build-cli-bundle.mjs
  • prepublishOnlypnpm build
  • typechecktsc --noEmit
Dependencies7
  • @agentclientprotocol/sdk^0.22.1
  • @fastify/static^8.0.4
  • @fastify/websocket^11.0.2
  • better-sqlite3^12.10.0
  • chokidar^5.0.0
  • fastify^5.1.0
  • open^10.1.0